Loading story…
Apache Tomcat's form-based authentication implementation contains a session-fixation flaw tracked as CVE-2013-2067. In affected FormAuthenticator.java code, the application improperly associates authentication requirements with HTTP sessions, allowing a remote attacker to inject a request into a victim's session while the victim completes a login form.
Affected releases include Apache Tomcat 6.0.21 through 6.0.36 and Tomcat 7.x before 7.0.33. Organizations using these versions should upgrade to a fixed Tomcat release and review applications using form authentication for exposure to session-fixation and unauthorized request injection.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Oracle included CVE-2013-2067 as a referenced issue in its October 2016 Critical Patch Update advisory.
Oracle referenced CVE-2013-2067 in its January 2014 Critical Patch Update advisory.
CVE-2013-2067 was published for a session-fixation flaw in Apache Tomcat's FormAuthenticator. The flaw affects Tomcat 6.0.21 through 6.0.36 and Tomcat 7.x versions before 7.0.33, allowing request injection during form-login completion.
Red Hat issued advisories RHSA-2013:0833, RHSA-2013:0834, RHSA-2013:0839, RHSA-2013:0964, and RHSA-2013:1437, while Ubuntu published USN-1841-1, for the Tomcat vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourceubuntu.com
Open sourcelaunchpad.net
Open sourceoracle.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache Tomcat remediated a group of vulnerabilities affecting multiple supported release lines. **CVE-2026-55957** allows authentication bypass in `JNDIRealm` deployments that use GSSAPI-authenticated binds, while **CVE-2026-55956** can cause Default Servlet security constraints to incorrectly handle specified HTTP methods or method omissions. **CVE-2026-55955** permits replay attacks against the cluster-component `EncryptionInterceptor`, and **CVE-2026-43514** exposes a timing discrepancy in AJP secret comparison that may aid secret-value inference. Tomcat also corrected **CVE-2026-53434**, in which invalid certificate-revocation-list configuration for an FFM-based connector might not produce an error, and **CVE-2026-55276**, where effective `web.xml` logging could omit special roles and empty authorization constraints. Organizations should upgrade affected deployments to supported fixed releases: generally Tomcat **11.0.23**, **10.1.56**, or **9.0.119** for the June issues; the JNDIRealm authentication-bypass advisory specifies **11.0.5**, **10.1.37**, or **9.0.101**. Tomcat 8.0 and 8.5 are end of life and should be migrated to a supported branch rather than retained without security fixes.
Aug 28, 2026
Apache Tomcat has remediated **CVE-2026-65182**, a critical improper authorization and access-control flaw (**CVSS 9.1**) that can let an unauthenticated remote attacker bypass configured security constraints. The issue arises when a constraint for a longer URL path is declared before a more restrictive constraint for a shorter subpath, causing Tomcat to apply access controls incorrectly. No public exploitation was known at the time of the notices. Affected releases include Tomcat 7.0.0–7.0.109, 8.5.0–8.5.100, 9.0.0.M1–9.0.120, 10.1.0-M1–10.1.57, and 11.0.0-M1–11.0.24, including deployments using embedded Tomcat libraries. Organizations should identify exposed instances and update to fixed releases—Tomcat 9.0.121, 10.1.58 or later, and 11.0.25 or later—while validating URL security-constraint ordering after remediation.
Sep 3, 2026
Apache released Tomcat **11.0.25**, **10.1.58**, and **9.0.121** to remediate 11 vulnerabilities across supported release lines. The most consequential issues include `CVE-2026-68569`, where DataSourceRealm principal lookup can fail open with mechanisms such as CLIENT-CERT or SPNEGO; `CVE-2026-65182`, which can bypass security constraints based on path-rule ordering; and `CVE-2026-65927`, an off-by-one RewriteValve error that may bypass access controls. `CVE-2026-68763` also permits denial of service through an HTTP/2 backlog-tracking allocation leak when streams are reset. The updates additionally address authorization bypasses involving FORM-authentication redirects (`CVE-2026-68525`) and `security-role-ref` aliases (`CVE-2026-66422`), a limited DIGEST-authentication replay condition (`CVE-2026-65905`), an HTTP/2 strict-SNI-validation bypass from an incomplete prior fix (`CVE-2026-65637`), a Unix-domain-socket permission race (`CVE-2026-65183`), and WebSocket sessions that can survive expiration of their associated HTTP session (`CVE-2026-73180`). Organizations should prioritize upgrades, particularly for internet-facing deployments; Tomcat 7 and 8.5 installations are end of life and should be retired or otherwise remediated. No confirmed in-the-wild exploitation or public proof-of-concept code was reported.
Aug 31, 2026